Or they just wanted to get ahead and tried to buy gil and got their account stolen. Or just visited one of the sites and got a keylogger installed.
Thats my prime 2 suspects. Doubt anyone falls for email phising anymore in this age ._.